Zephyr RTOS CVE-2026-10685

The target must be a Zephyr RTOS device operating in the GATT client role - specifically, it must have called bt_gatt_subscribe() to register for notifications from a remote GATT server. The vulnerability is triggered only when the remote GATT server (controlled by the attacker) replies to the CCC-write request with an ATT Error Response; a compliant server returning success does not trigger the path. Memory corruption additionally requires that the application's notify termination callback (called with NULL data) frees or recycles the bt_gatt_subscribe_params struct, which is the API-documented pattern but not universal. Applications that never free or reuse the struct in the notify callback will still receive the out-of-order subscribe callback but will not experience a use-after-free. Exploitation is bounded to Bluetooth adjacency - the attacker must be within radio range and must successfully complete Bluetooth pairing or connection to the victim device (depending on the device's pairing requirements). Authentication is not required from the attacker's perspective since they operate as the peer server role.

The CVSS 7.6 with AV:A accurately captures the most critical real-world constraint: the attacker must be within Bluetooth radio range of the target. This is a meaningful physical-proximity barrier that substantially reduces the exposed attack surface compared to network-reachable flaws of similar score. AC:L reflects that triggering the condition requires only a single ATT Error Response - no complex exploit chain. PR:N is correct from the attacker's vantage as the peer GATT server. A:H dominates the score and reflects the most reliable impact: a crash resulting from a bad function-pointer dereference. C:L and I:L acknowledge that memory corruption opens a theoretical path to controlled code execution, but this is highly dependent on heap layout and application behavior at the time of exploitation. No EPSS data was provided and the CVE is not in CISA KEV, indicating no confirmed or widespread exploitation. The requirement that the target application also frees or recycles bt_gatt_subscribe_params inside the notify termination handler is a second prerequisite that further limits the exploitable population to applications following the documented lifecycle pattern.

An attacker within Bluetooth radio range of a Zephyr GATT client device advertises as a GATT server and accepts the client connection. When the Zephyr device calls bt_gatt_subscribe() and sends a CCC write to register for notifications, the attacker replies with an ATT Error Response containing an arbitrary error code. This drives the vulnerable gatt_write_ccc_rsp() code path: notify(NULL) fires first, the application frees bt_gatt_subscribe_params, and then the handler calls params->subscribe() through the now-freed function pointer - crashing the device or, with pre-conditioned heap state, redirecting execution. No public proof-of-concept code has been identified at time of analysis.